CVE-2026-25935 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since th…
High CVSS: 8.6

CVE-2026-25935

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.
Vendor
Vikunja
Product
Vikunja
CWE
CWE-80
Yayın Tarihi
2026-02-11 21:16:20
Güncelleme
2026-02-20 20:17:54
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-80 Vikunja HIGH Vikunja 2026

Referanslar

https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37 https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v https://vikunja.io/changelog/vikunja-v1.1.0-was-released